Model Specific Registers A look at Intel s scheme for introducing new CPU features Microprocessor evolution 8080 64K memory 8 bit registers no mul div no FPU 1973 8086 1M memory 16 bit registers I O ports 8087 option 1978 80186 1981 Ins outs shift rotate immediate integrated DMA PIC Timers 80286 1982 16M memory protected mode multitasking 80287 option 80386 Added TR6 TR7 4GB memory 32 bit registers paging 287 387 options 1985 80486 Added TR3 TR4 TR5 Integrated FPU RISC cacheing xadd APIC option 1989 Removed TR3 TR4 TR5 TR6 TR7 1993 80586 Pentium MMX instructions integrated local APIC MSRs dual pipelines branch prediction The Model Specific concept Beginning with the Pentium processor Intel has been including experimental features in its processors warning that they may disappear from future designs but providing a standard and permanent way for all such features to be accessed This access is via a pair of privileged instructions rdmsr and wrmsr that can only be executed by ring0 code Quite a few MSRs now At first there were only about a dozen of these MSRs Model Specific Registers but lately their number is well over 200 Some MSRs have evidently proven to be sufficiently satisfactory and worth having that they are now deemed as permanent fixtures of the defined i386 architecture The Time Stamp Counter This 64 bit Model Specific Register was introduced in the Pentium processor and has been present in each CPU thereafter It increments once every CPU clock cycle starting from 0 when power is turned on It won t overflow for at least ten years Unprivileged programs ring3 normally can access it via the rdtsc instruction Using the TSC 64 bits 63 32 31 EDX time0 time1 quad quad 0 0 0 EAX saves starting value from the TSC saves concluding value from TSC how you can measure CPU clock cycles in a code fragment rdtsc read the Time Stamp Counter movl eax time0 0 save least significant longword movl edx time0 4 save most significant longword Your code fragment to be measured goes here rdtsc read the Time Stamp Counter movl eax time1 0 save least significant longword movl edx time1 4 save most significant longword now subtract starting value time0 from ending value time1 The TSC as an MSR Each Model Specific Register has its own identifying register number and it can be accessed from ring0 using the special pair of instructions rdmsr and wrmsr The Time Stamp Counter is MSR number 0x10 To write a new 64 bit value into the TSC you load the desired 64 bit value into the EDX EAX register pair you put the MSR ID number 0x10 into register ECX then you execute wrmsr IA32 APIC BASE This register has MSR number 0x1B and is private to each CPU in an SMP system It establishes the base address for the Local APIC s memory mapped registers the default base address is 0xFEE00000 but that can be changed using this MSR The CPU s Local APIC functions can be either enabled or disabled via bit 11 The BSP can be recognized via bit 8 Relocating the APIC registers IA32 APIC BASE 64 bits 63 32 31 reserved 12 11 APIC base address 4K page number E N 8 B S P Default value for APIC base address page 0xFEE00 Local APIC Enable bit 1 enabled 0 disabled Boot Strap Processor read only 1 yes 0 no make the processor s Local APIC registers accessible in real mode mov 0x000D8000 eax least significant 32 bits mov 0x00000000 edx most significant 32 bits mov 0x1B ecx MSR register number wrmsr write to specified MSR 0 Extended Feature Enable Register This Model Specific Register MSR was introduced in the AMD64 architecture and perpetuated by EM64T for compatibility 63 11 10 8 0 N L X M E A L M E S C E Legend SCE SysCall sysret is Enabled 1 yes 0 no LME Long Mode is Enabled 1 yes 0 no LMA Long Mode is Active 1 yes 0 no NXE Non eXecutable pages Enabled 1 yes 0 no NOTE The MSR address index for EFER 0xC0000080 and this register is accessed using RDMSR or WRMSR instructions The x86 operating modes Virtual 8086 mode 64 bit mode Power on Real mode Protected mode System Management mode IA 32e mode Compatibility mode Why CPU s mode matters Key differences among the x86 modes How memory is addressed and mapped What instruction set is available Which registers are accessible Which exceptions may be generated What data structures are required How task switching can be accomplished How interrupts will be processed Mode transitions The processor starts up in real mode Mode transitions normally happen under program control except for transitions to the so called System Management Mode Details of programming a mode change depend on which modes are involved Some mode transfers aren t possible 64 bit mode offers a lot of surprises Registers in 64 bit mode EAX ECX EDX EBX ESP EBP ESI EDI EIP EFLAGS RAX RCX RDX RBX RSP RBP RSI RDI RIP RFLAGS 63 CR0 CR2 CR3 CR4 DR0 DR1 DR2 DR3 DR6 DR7 R8 R9 R10 R11 R12 R13 R14 R15 CR8 32 31 16 15 8 7 0 RAX EAX AX AL Some missing features Memory segmentation is turned off Base address is zero for CS DS ES SS Segment limit checking is not performed Certain familiar instructions no longer are defined while executing in 64 bit mode Cannot use pusha and popa Cannot ljmp or lcall with direct addressing Cannot use lahf and sahf canonical addresses 00000 00001 00010 00011 00100 00101 00110 00111 01000 01001 01010 01011 01100 01101 01110 01111 10000 10001 10010 10011 10100 10101 10110 10111 11000 11001 11010 11011 11100 11101 11110 11111 0xFFFFFFFFFFFFFFFF 0xFFFF800000000000 Analogy using 5 bit values 64 bit vrtual address space 0x00007FFFFFFFFFFF 0x0000000000000000 canonical addresses non canonical invalid virtual addresses canonical addresses 4 Levels of mapping 63 48 47 sign extension 39 38 PML4 30 29 PDPT 21 20 PDIR 12 11 PTBL 0 offset 64 bit canonical virtual address Page Table Page Map Level 4 Table CR3 Page Directory Pointer Table Page Frame 4KB Page Directory Each mapping table contains up to 512 quadword size entries 4 level address translation The CPU examines any virtual address it encounters subdividing it into five fields 63 48 47 signextension 16 bits 39 38 30 29 index into index into level 4 pagepage map directory table pointer table 9 bits 9 bits 21 20 12 11 index into pagedirectory index into page table 9 bits 9 bits 0 offset into page frame 12 bits Any 48 bit virtual address is sign extended to a 64 bit canonical address Only canonical 64 bit virtual addresses are legal in 64 bit mode Format of 64 bit table entries Physical addresses on our current Core 2 CPUs are only 40 bits 63 62 E X B 52 51 avl 40 39 Page